RustDesk Clients

Operational guide for configuring RustDesk client devices to connect to the self-hosted RustDesk Pro server.

Quick Reference

Property	Value
Server hostname	`rd.fzymgc.house`
Hosted on	DigitalOcean edge node (`edge-node.fzymgc.house`) — not in the k3s cluster
Server software	`rustdesk/rustdesk-server-pro:latest` (Docker Compose at `/opt/docker-compose/rustdesk/`)
Admin web console	`https://rd.fzymgc.house` (Caddy → host port 21114)
Server public key	`b8bINm1Ykg+QWpMDqW43Ri6JAnm+khe6Sn8mAr1w+7A=` (see Re-fetching the key — rotation = re-config every client)

Client Configuration

Every RustDesk client (desktop or mobile) needs four fields. The Key is the only one that’s hard to recover if mistyped — clients silently fail their handshake on key mismatch with no UI error.

Field	Value	Notes
ID Server	`rd.fzymgc.house`	The hbbs rendezvous server. Client tries TCP/UDP 21116, falls back through 21115/21118/21119 automatically. Do not include a port.
Relay Server	`rd.fzymgc.house` or leave blank	hbbs advertises the relay address dynamically. Leave blank unless you specifically want to override what the server tells the client.
API Server	`https://rd.fzymgc.house`	Required only for Pro features (address book, user accounts, audit log). Note the `https://` prefix — required.
Key	`b8bINm1Ykg+QWpMDqW43Ri6JAnm+khe6Sn8mAr1w+7A=`	Server’s `id_ed25519.pub`. Mismatch = silent connection failure.

No per-client license key, API token, or password is needed for basic connectivity. The server is licensed; clients are free.

Where to enter it

Client	Path
macOS / Windows / Linux desktop	Gear icon → Settings → Network → fill ID Server + Key. Apply.
iOS / Android	Settings (top-right) → ID/Relay Server → fill the same fields.
Web client (`https://rd.fzymgc.house`)	The web client uses the server’s own configuration; nothing to enter.

Faster: paste a config string

Instead of typing four fields per device, generate a base64 config blob and paste it. RustDesk desktop clients have an Import server config from clipboard button under Settings → Network.

python3 -c '
import base64, json
cfg = {
  "host": "rd.fzymgc.house",
  "key":  "b8bINm1Ykg+QWpMDqW43Ri6JAnm+khe6Sn8mAr1w+7A=",
  "api":  "https://rd.fzymgc.house",
  "relay":""
}
print(base64.b64encode(json.dumps(cfg).encode()).decode())
' | pbcopy

The admin web console can also generate a QR-codeable string under Settings → Strategies — easier for non-technical users.

Pro features (address book, audit, groups)

After basic config is in place, end-users sign in inside the client:

Client → Settings → Account → Sign In
Use the username/password created in the admin web console at https://rd.fzymgc.house → Users

Once signed in:

The address book on https://rd.fzymgc.house syncs into the client
Audit log captures every session on the server
Group permissions (rustdesk-server-pro 1.4+) take effect

Server-Side Operations

First-time admin setup

Browse to https://rd.fzymgc.house
Default credentials: admin / test1234 — change immediately
Settings → License — confirm Pro license is registered (binds to the server’s machine identity)
Users — create a real admin account, then disable or delete the default admin

Re-fetching the public key

If you ever lose track of the key (or need to verify a client is using the correct one):

ssh root@edge-node 'cat /opt/docker-compose/rustdesk/data/id_ed25519.pub'

Key rotation has a blast radius. If id_ed25519 is regenerated (e.g., the data volume is wiped), every client’s stored Key becomes invalid and connections silently fail. Rotation is a coordinated event: regenerate, then update every client’s Key field. Avoid casual deletion of /opt/docker-compose/rustdesk/data/.

Verifying a client connection

Tail the hbbs container while the client tries to connect:

ssh root@edge-node 'docker logs -f rustdesk-hbbs 2>&1 | grep -E "Punch hole|Listen|tcp"'

A successful connect produces lines like INFO ... Punch hole <id> <peer-ip>:<port> request from <client-ip>:<port>. Absence of these lines after a client tries to connect = the client never reached hbbs (likely DNS, firewall, or wrong key).

Restarting the server

ssh root@edge-node 'cd /opt/docker-compose/rustdesk && docker compose restart'

hbbs and hbbr both read id_ed25519 from /opt/docker-compose/rustdesk/data/ at startup, so the key is preserved across restarts.

Logs and license

ssh root@edge-node 'docker logs --tail 200 rustdesk-hbbs'      # signal/rendezvous logs
ssh root@edge-node 'docker logs --tail 50  rustdesk-hbbr'      # relay logs

The hbbs log shows weekly license heartbeats — INFO [src/lic.rs] Checking license ... followed by License OK. If license checks ever fail, hbbs will refuse new connections.

Network Architecture

Port	Service	Protocol	Use
443	Caddy	TCP/TLS	Admin/API console (proxies to 21114)
21114	hbbs	TCP	Web console / API (host-only; behind Caddy)
21115	hbbs	TCP	NAT-type test
21116	hbbs	TCP + UDP	Rendezvous / signal — primary client port
21117	hbbr	TCP	Relay (when direct connection fails)
21118	hbbs	TCP (WebSocket)	Web-client signal fallback
21119	hbbr	TCP (WebSocket)	Web-client relay fallback

Public DNS (Cloudflare zone, not in this repo’s Terraform) for rd.fzymgc.house:

Type	Value	Proxy
A	`157.230.201.90`	DNS only (gray) — must be gray; Cloudflare proxy can’t carry rustdesk’s TCP/UDP ports
AAAA	DigitalOcean v6 of the edge droplet	DNS only (gray)

Troubleshooting

Client stuck on “Trying to connect…”

In order of likelihood:

Wrong Key. Verify Key field exactly matches id_ed25519.pub on the edge node (see Re-fetching the public key). The client UI shows no error for key mismatch — it silently retries forever.
Firewall blocking 21116/21117. Rustdesk’s signal and relay ports are not HTTP. Some networks (corporate, hotel Wi-Fi, captive portals) block non-HTTP outbound. Test from the client’s network: nc -zv rd.fzymgc.house 21116.
DNS pointing at the wrong host. Confirm public DNS resolves to the edge droplet’s IPs (dig rd.fzymgc.house A AAAA). If LAN clients see different IPs (split-horizon), the LAN view should also resolve to the public IPs — there’s no in-cluster rustdesk anymore.
License lapsed. Check hbbs logs for License check failed.

API Server field missing or wrong protocol. Must be https://rd.fzymgc.house exactly (not http://, not bare rd.fzymgc.house).

”Permission denied” on remote control

Pro permission groups are denying the action. Check Users → Permissions in the admin console for the signed-in user.

Server data volume: /opt/docker-compose/rustdesk/data/ on edge-node (contains id_ed25519, db_v2.sqlite3, license token)
Caddy reverse proxy config: /etc/caddy/sites/rustdesk.fzymgc.house.conf (filename is legacy; the server name inside is rd.fzymgc.house)
Historical k3s deployment design: the archived plan (2026-03-01-rustdesk-pro-design.md, pruned from the docs site; see VCS history) — the rustdesk service was migrated out of k3s onto this edge node in 2026-03; do not act on the archived k3s plan